Make Narratio configuration ownership configurable

README.md

@@ -18,6 +18,10 @@ narratio_go_binary: /snap/bin/go
 narratio_user: narratio
 narratio_group: narratio
 narratio_config_path: /usr/local/etc/narratio/pipeline.yml
+narratio_config_owner: root
+narratio_config_group: narratio
+narratio_config_directory_mode: "0750"
+narratio_config_file_mode: "0640"
 narratio_workspace_root: /var/lib/narratio
 narratio_campaigns_root: /usr/local/share/narratio/campaigns
 narratio_spool_root: /var/spool/narratio
@@ -117,8 +121,11 @@ rebuilds only when the checkout changes or the binary is absent.
 
 The `narratio` account owns the workspace, spool, and cache roots, which are
 group-writable setgid directories. The campaign registry is `root:narratio`
-and operator-readable; its content remains caller-managed. The configuration
-directory is `root:narratio` mode `0750`, and the pipeline is mode `0640`.
+and operator-readable; its content remains caller-managed. Configuration
+ownership and modes are independently configurable: the standalone defaults
+are `root:narratio`, mode `0750` for the directory and `0640` for the managed
+pipeline file. Composing roles may override these inputs without changing the
+writable-root policy.
 
 Null pipeline values and their empty parent mappings are omitted; non-null
 falsey values are preserved. `narratio_publish_outputs`,

defaults/main.yml

@@ -9,6 +9,10 @@ narratio_go_binary: /snap/bin/go
 narratio_user: narratio
 narratio_group: narratio
 narratio_config_path: /usr/local/etc/narratio/pipeline.yml
+narratio_config_owner: root
+narratio_config_group: "{{ narratio_group }}"
+narratio_config_directory_mode: "0750"
+narratio_config_file_mode: "0640"
 narratio_workspace_root: /var/lib/narratio
 narratio_campaigns_root: /usr/local/share/narratio/campaigns
 narratio_spool_root: /var/spool/narratio

meta/argument_specs.yml

@@ -13,6 +13,10 @@ argument_specs:
       narratio_user: {type: str, required: true}
       narratio_group: {type: str, required: true}
       narratio_config_path: {type: path, required: true}
+      narratio_config_owner: {type: str, required: true}
+      narratio_config_group: {type: str, required: true}
+      narratio_config_directory_mode: {type: str, required: true}
+      narratio_config_file_mode: {type: str, required: true}
       narratio_workspace_root: {type: path, required: true}
       narratio_campaigns_root: {type: path, required: true}
       narratio_spool_root: {type: path, required: true}

tasks/main.yml

@@ -58,9 +58,9 @@
   ansible.builtin.file:
     path: "{{ narratio_config_path | dirname }}"
     state: directory
-    owner: root
-    group: "{{ narratio_group }}"
-    mode: "0750"
+    owner: "{{ narratio_config_owner }}"
+    group: "{{ narratio_config_group }}"
+    mode: "{{ narratio_config_directory_mode }}"
 
 - name: Create mutable Narratio roots
   become: true
@@ -142,6 +142,6 @@
   ansible.builtin.template:
     src: pipeline.yml.j2
     dest: "{{ narratio_config_path }}"
-    owner: root
-    group: "{{ narratio_group }}"
-    mode: "0640"
+    owner: "{{ narratio_config_owner }}"
+    group: "{{ narratio_config_group }}"
+    mode: "{{ narratio_config_file_mode }}"